shorewall-mangle

title: shorewall-mangle(5)

text:
# shorewall-mangle(5)

## NAME
mangle - Shorewall Packet marking/mangling rules file

## SYNOPSIS
/etc/shorewall[6]/mangle

## DESCRIPTION
This file was introduced in Shorewall 4.6.0 and replaces shorewall-tcrules(5)[1]. This file is only processed by the compiler if:

Entries in this file cause packets to be marked as a means of classifying them for traffic control or policy routing.

Important

Unlike rules in the shorewall-rules[2](5) file, evaluation of rules in this file will continue after a match. So the final mark for each packet will be the one assigned by the LAST tcrule that matches.

If you use multiple internet providers with the 'track' option, in /etc/shorewall/providers be sure to read the restrictions at http://www.shorewall.net/MultiISP.html[3].

The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax).

ACTION - command[(parameters)][:chain-designator]

The chain-designator indicates the Netfilter chain that the entry applies to and may be one of the following: P

PREROUTING chain.

F

FORWARD chain.

T

POSTROUTING chain.

I

INPUT chain.

NP

PREROUTING chain in the nat table.

NI

INPUT chain in the nat table.

NO

OUTPUT chain in the nat table.

NT

POSTROUTING chain in the nat table.

The nat table designators were added in Shorewall 5.2.1. When a nat table designator is given, only the CONNMARK, MARK, SAVE and RESTORE commands may be used.

Unless otherwise specified for the particular command, the default chain is PREROUTING when MARK_IN_FORWARD_CHAIN=No in shorewall.conf(5)[4], and FORWARD when MARK_IN_FORWARD_CHAIN=Yes.

A chain-designator may not be specified if the SOURCE or DEST columns begin with '$FW'. When the SOURCE is $FW, the generated rule is always placed in the OUTPUT chain. If DEST is '$FW', then the rule is placed in the INPUT chain. Additionally, a chain-designator may not be specified in an action body.

Where a command takes parameters, those parameters are enclosed in parentheses ("(....)") and separated by commas.

The command may be one of the following.

action[([param[,...])]

Added in Shorewall 5.0.7. action must be an action declared with the mangle option in shorewall-actions(5)[5]. If the action accepts parameters, they are specified as a comma-separated list within parentheses following the action name.

ADD(ipset:flags)

Added in Shorewall 4.6.7. Causes addresses and/or port numbers to be added to the named ipset. The flags specify the address or tuple to be added to the set and must match the type of ipset involved. For example, for an iphash ipset, either the SOURCE or DESTINATION address can be added using flags src or dst respectively (see the -A command in ipset (8)). ADD is non-terminating. Even if a packet matches the rule, it is passed on to the next rule.

CHECKSUM

Compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful if you need to work around old applications, such as dhcp clients, that do not work well with checksum offloads, but you don't want to disable checksum offload in your device. Requires 'Checksum Target' support in your kernel and iptables.

CLASSIFY(classid)

A classification Id (classid) is of the form major:minor where major and minor are integers. Corresponds to the 'class' specification in these traffic shaping modules:

```
       atm

       cbq

       dsmark

       pfifo_fast

       htb

       prio
```

Classification occurs in the POSTROUTING chain except when the SOURCE is $FW[:address] in which case classification occurs in the OUTPUT chain.

When using Shorewall's built-in traffic shaping tool, the major class is the device number (the first device in shorewall-tcdevices[6](5) is major class 1, the second device is major class 2, and so on) and the minor class is the class's MARK value in shorewall-tcclasses[7](5) preceded by the number 1 (MARK 1 corresponds to minor class 11, MARK 5 corresponds to minor class 15, MARK 22 corresponds to minor class 122, etc.).

?COMMENT

The rest of the line will be attached as a comment to the Netfilter rule(s) generated by the following entries. The comment will appear delimited by "/* ... */" in the output of shorewall show mangle To stop the comment from being attached to further rules, simply include ?COMMENT on a line by itself.

CONMARK({mark|range})

Identical to MARK with the exception that the mark is assigned to connection to which the packet belongs is marked rather than to the packet itself.

CONTINUE

Don't process any more marking rules in the table. Currently, CONTINUE may not be used with exclusion (see the SOURCE and DEST columns below); that restriction will be removed when iptables/Netfilter provides the necessary support.

DEL(ipset:flags)

Added in Shorewall 4.6.7. Causes an entry to be deleted from the named ipset. The flags specify the address or tuple to be deleted from the set and must match the type of ipset involved. For example, for an iphash ipset, either the SOURCE or DESTINATION address can be deleted using flags src or dst respectively (see the -D command in ipset (8)). DEL is non-terminating. Even if a packet matches the rule, it is passed on to the next rule.

DIVERT

Two DIVERT rule should precede the TPROXY rule and should select DEST PORT tcp 80 and SOURCE PORT tcp 80 respectively (assuming that tcp port 80 is being proxied). DIVERT avoids sending packets to the TPROXY target once a socket connection to Squid3 has been established by TPROXY. DIVERT marks the packet with a unique mark and exempts it from any rules that follow.

DIVERTHA

Added in Shorewall 5.0.4. To setup the HAProxy configuration described at http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x, place this entry in shorewall-providers(5)[8]:

```
#NAME    NUMBER   MARK    DUPLICATE  INTERFACE GATEWAY         OPTIONS               COPY
TProxy   1        -       -          lo        -               tproxy
```

and use this DIVERTHA entry:

```
#ACTION         SOURCE          DEST            PROTO   DPORT   SPORT   USER    TEST    LENGTH  TOS   CONNBYTES         HELPER    PROBABILITY DSCP
DIVERTHA        -               -               tcp
```

DROP

Causes matching packets to be discarded.

DSCP(dscp)

Sets the Differentiated Services Code Point field in the IP header. The dscp value may be given as an even number (hex or decimal) or as the name of a DSCP class. Valid class names and their associated hex numeric values are:

```
    CS0  => 0x00

    CS1  => 0x08

    CS2  => 0x10

    CS3  => 0x18

    CS4  => 0x20

    CS5  => 0x28

    CS6  => 0x30

    CS7  => 0x38

    BE   => 0x00

    AF11 => 0x0a

    AF12 => 0x0c

    AF13 => 0x0e

    AF21 => 0x12

    AF22 => 0x14

    AF23 => 0x16

    AF31 => 0x1a

    AF32 => 0x1c

    AF33 => 0x1e

    AF41 => 0x22

    AF42 => 0x24

    AF43 => 0x26

    EF   => 0x2e
```

To indicate more than one class, add their hex values together and specify the result. By default, DSCP rules are placed in the POSTROUTING chain.

ECN

Added in Shorewall 5.0.6 as an alternative to entries in shorewall-ecn(5)[9]. If a PROTO is specified, it must be 'tcp' (6). If no PROTO is supplied, TCP is assumed. This action causes all ECN bits in the TCP header to be cleared.

IMQ(number)

Specifies that the packet should be passed to the IMQ identified by number. Requires IMQ Target support in your kernel and iptables.

INLINE[(action)]

Allows you to place your own ip[6]tables matches at the end of the line following a semicolon (";") (deprecated) or two semicolons (";;") (preferred since Shoreall 5.0.0). If an action is specified, the compiler proceeds as if that action had been specified in this column. If no action is specified, then you may include your own jump ("-j target [option] ...") after any matches specified at the end of the rule. If the target is not one known to Shorewall, then it must be defined as a builtin action in shorewall-actions[10] (5). The following rules are equivalent:

```
2:P                   eth0              -         tcp 22
INLINE(MARK(2)):P     eth0              -         tcp 22
INLINE(MARK(2)):P     eth0              -                 ;; -p tcp
INLINE                eth0              -         tcp 22  ;; -j MARK --set-mark 2
INLINE                eth0              -                 ;; -p tcp -j MARK --set-mark 2
```

IPMARK

Assigns a mark to each matching packet based on the either the source or destination IP address. By default, it assigns a mark value equal to the low-order 8 bits of the source address. Default values are: src

mask1 = 0xFF

mask2 = 0x00

shift = 0

'src' and 'dst' specify whether the mark is to be based on the source or destination address respectively. The selected address is first shifted to the right by shift bits. The result is then LANDed with mask1 then LORed with mask2. In a sense, the IPMARK target is more like an IPCLASSIFY target in that the mark value is later interpreted as a class ID. A packet mark is 32 bits wide; so is a class ID. The <major> class occupies the high-order 16 bits and the <minor> class occupies the low-order 16 bits. So the class ID 1:4ff (remember that class IDs are always in hex) is equivalent to a mark value of 0x104ff. Remember that Shorewall uses the interface number as the <major> number where the first interface in tcdevices has <major> number 1, the second has <major> number 2, and so on.

The IPMARK target assigns a mark to each matching packet based on the either the source or destination IP address. By default, it assigns a mark value equal to the low-order 8 bits of the source address. The syntax is as follows: IPMARK[([{src|dst}][,[mask1][,[mask2][,[shift]]]])] Default values are:

src

mask1 = 0xFF

mask2 = 0x00

shift = 0

src and dst specify whether the mark is to be based on the source or destination address respectively. The selected address is first shifted right by shift, then LANDed with mask1 and then LORed with mask2. The shift argument is intended to be used primarily with IPv6 addresses. Example: IPMARK(src,0xff,0x10100)

Suppose that the source IP address is 192.168.4.3

= 0xc0a80403; then

0xc0a80403 >> 0 = 0xc0a80403

0xc0a80403 LAND 0xFF = 0x03

0x03 LOR 0x10100 = 0x10103 or class ID

1:103

It is important to realize that, while class IDs are composed of a major and a minor value, the set of values must be unique. That is, the same numeric value cannot be used as both a major and a minor number for the same interface unless class nesting occurs (which is not currently possible with Shorewall). You should keep this in mind when deciding how to map IP addresses to class IDs. For example, suppose that your internal network is 192.168.1.0/29 (host IP addresses 192.168.1.1 - 192.168.1.6). Your first notion might be to use IPMARK(src,0xFF,0x10000) so as to produce class IDs 1:1 through 1:6. But 1:1 is an invalid class ID since the major and minor classes are equal. So you might choose instead to use IPMARK(src,0xFF,0x10100) as in the example above so that all of your minor classes will have a value > 256.

IP6TABLES({target [option ...])

IPv6 only. This action allows you to specify an iptables target with options (e.g., 'IP6TABLES(MARK --set-xmark 0x01/0xff)'. If the target is not one recognized by Shorewall, the following error message will be issued:

ERROR: Unknown target

(target)

This error message may be eliminated by adding the target as a builtin action in shorewall-actions(5)[10].

IPTABLES({target [option ...])

IPv4 only. This action allows you to specify an iptables target with options (e.g., 'IPTABLES(MARK --set-xmark 0x01/0xff)'. If the target is not one recognized by Shorewall, the following error message will be issued:

ERROR: Unknown target

(target)

This error message may be eliminated by adding the target as a builtin action in shorewall-actions(5)[10].

MARK({mark|range})

where mark is a packet mark value. Normally will set the mark value. If preceded by a vertical bar ("|"), the mark value will be logically ORed with the current mark value to produce a new mark value. If preceded by an ampersand ("&"), will be logically ANDed with the current mark value to produce a new mark value.

Both "|" and "&" require Extended MARK Target support in your kernel and iptables.

The mark value may be optionally followed by "/" and a mask value (used to determine those bits of the connection mark to actually be set). When a mask is specified, the result of logically ANDing the mark value with the mask must be the same as the mark value.

A mark range is a pair of integers separated by a dash ("-").

May be optionally followed by a slash ("/") and a mask and requires the Statistics Match capability in iptables and kernel. Marks in the specified range are assigned to packets on a round-robin fashion.

When a mask is specified, the result of logically ANDing each mark value with the mask must be the same as the mark value. The least significant bit in the mask is used as an increment. For example, if '0x200-0x400/0xff00' is specified, then the assigned mark values are 0x200, 0x300 and 0x400 in equal proportions. If no mask is specified, then ( 2 ** MASK_BITS ) - 1 is assumed (MASK_BITS is set in shorewall.conf[4](5)).

NFLOG[(nflog-parameters)]

Added in Shorewall 5.0.9. Logs matching packets using NFLOG. The nflog-parameters are a comma-separated list of up to 3 numbers:

•The first number specifies the netlink group (0-65535). If omitted (e.g., NFLOG(,0,10)) then a value of 0 is assumed.

•The second number specifies the maximum number of bytes to copy. If omitted, 0 (no limit) is assumed.

•The third number specifies the number of log messages that should be buffered in the kernel before they are sent to user space. The default is 1.

RESTORE[(mask)]

Restore the packet's mark from the connection's mark using the supplied mask if any. Your kernel and iptables must include CONNMARK support.

SAME[(timeout)]

Some websites run applications that require multiple connections from a client browser. Where multiple 'balanced' providers are configured, this can lead to problems when some of the connections are routed through one provider and some through another. The SAME target allows you to work around that problem. SAME may be used in the PREROUTING and OUTPUT chains. When used in PREROUTING, it causes matching connections from an individual local system to all use the same provider. For example:

```
#ACTION           SOURCE         DEST         PROTO      DPORT
SAME:P            192.168.1.0/24 0.0.0.0/0    tcp        80,443
```

If a host in 192.168.1.0/24 attempts a connection on TCP port 80 or 443 and it has sent a packet on either of those ports in the last five minutes then the new connection will use the same provider as the connection over which that last packet was sent.

When used in the OUTPUT chain, it causes all matching connections to an individual remote system to all use the same provider. For example:

```
#ACTION           SOURCE         DEST         PROTO      DPORT
SAME              $FW            0.0.0.0/0    tcp        80,443
```

The optional timeout parameter was added in Shorewall 4.6.7 and specifies a number of seconds . When not specified, a value of 300 seconds (5 minutes) is assumed. If the firewall attempts a connection on TCP port 80 or 443 and it has sent a packet on either of those ports in the last timeout seconds to the same remote system then the new connection will use the same provider as the connection over which that last packet was sent.

SAVE[(mask)]

Save the packet's mark to the connection's mark using the supplied mask if any. Your kernel and iptables must include CONNMARK support.

TCPMSS([mss[,ipsec]])

Added in Shorewall 5.1.9. This target only applies to TCP traffic and alters the MSS value in SYN packets. It may be used in the FORWARD and POSTROUTING chains; the default is FORWARD. The mss parameter may be either pmtu or an integer in the range 500:65533. The value pmtu automatically clamps the MSS value to (path_MTU - 40 for IPv4; -60 for IPv6). This may not function as desired where asymmetric routes with differing path MTU exist — the kernel uses the path MTU which it would use to send packets from itself to the source and destination IP addresses. Prior to Linux 2.6.25, only the path MTU to the destination IP address was considered by this option; subsequent kernels also consider the path MTU to the source IP address. If an integer is given, the MSS option is set to the specified value. If the MSS of the packet is already lower than mss, it will not be increased (from Linux 2.6.25 onwards) to avoid more problems with hosts relying on a proper MSS. If mss is omitted, pmtu is assumed.

The ipsec parameter determines whether the rule applies to IPSEC traffic (ipsec is passed), non-IPSEC traffic (none is passed) or both (all is passed). If omitted, all is assumed.

TOS(tos[/mask])

Sets the Type of Service field in the IP header. The tos value may be given as an number (hex or decimal) or as the name of a TOS type. Valid type names and their associated hex numeric values are:

```
Minimize-Delay       => 0x10,
Maximize-Throughput  => 0x08,
Maximize-Reliability => 0x04,
Minimize-Cost        => 0x02,
Normal-Service       => 0x00
```

To indicate more than one class, add their hex values together and specify the result.

When tos is given as a number, it may be optionally followed by '/' and a mask. When no mask is given, the value 0xff is assumed. When tos is given as a type name, the mask 0x3f is assumed.

The action performed is to zero out the bits specified by the mask, then set the bits specified by tos.

TPROXY([port[,address]])

Transparently redirects a packet without altering the IP header. Requires a tproxy provider to be defined in shorewall-providers[8](5). There are three parameters to TPROXY - neither is required:

•port - the port on which the proxy server is listening. If omitted, the original destination port.

•address - a local (to the firewall) IP address on which the proxy server is listening. If omitted, the IP address of the interface on which the request arrives.

TTL([-|+]number)

If + is included, packets matching the rule will have their TTL incremented by number. Similarly, if - is included, matching packets have their TTL decremented by number. If neither + nor - is given, the TTL of matching packets is set to number. The valid range of values for number is 1-255.

SOURCE - {-|source-spec[,...]}

where source-spec is one of: [!]interface

where interface is the logical name of an interface defined in shorewall-interfaces[11](5). Matches packets entering the firewall from the named interface. May not be used in CLASSIFY rules or in rules using the :T chain qualifier. Beginning with Shorweall 5.2.1, the interface may be preceded with '!' which matches all interfaces except the one specified.

address[,...][exclusion]

where address is: A host or network IP address. The name of an ipset preceded by a plus sign ("+").

A MAC address in Shorewall format (preceded by a tilde ("~") and using dash ("-") as a separator (e.g., ~00-A0-C9-15-39-78). Matches traffic whose source IP address matches one of the listed addresses and that does not match an address listed in the exclusion (see shorewall-exclusion[12](5)).

This form will not match traffic that originates on the firewall itself unless either <major><minor> or the :T chain qualifier is used in the ACTION column.

[!]interface:address,[...][exclusion]

This form combines the preceding two forms and matches when both the incoming interface and source IP address match. Beginning with Shorweall 5.2.1, the interface may be preceded with '!' which matches all interfaces except the one specified.

[!]interface:exclusion

This form matches packets arriving through the named interface and whose source IP address does not match any of the addresses in the exclusion. Beginning with Shorweall 5.2.1, the interface may be preceded with '!' which matches all interfaces except the one specified.

$FW

Matches packets originating on the firewall system. May not be used with a chain qualifier (:P, :F, etc.) in the ACTION column.

$FW:address[,...][exclusion]

where address is as above (MAC addresses are not permitted). Matches packets originating on the firewall and whose source IP address matches one of the listed addresses and does not match any address listed in the exclusion. May not be used with a chain qualifier (:P, :F, etc.) in the ACTION column.

$FW:exclusion

Matches traffic originating on the firewall, provided that the source IP address does not match any address listed in the exclusion.

Beginning with Shorewall 5.1.0, multiple source_specs, separated by commas, may be given provided that the following alternative forms are used: (address[,...][exclusion])

interface:(address[,...][exclusion])

interface:(exclusion)

$FW:(address[,...][exclusion])

$FW:(exclusion)

DEST - {-|dest-spec[,...]}

where dest-spec is one of: interface

where interface is the logical name of an interface defined in shorewall-interfaces[11](5). Matches packets leaving the firewall through the named interface. May not be used in the PREROUTING chain (:P in the mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in shorewall.conf[13] (5)).

address[,...][exclusion]

where address is: A host or network IP address. The name of an ipset preceded by a plus sign ("+").

A MAC address in Shorewall format (preceded by a tilde ("~") and using dash ("-") as a separator (e.g., ~00-A0-C9-15-39-78). Matches traffic whose destination IP address matches one of the listed addresses and that does not match an address listed in the exclusion (see shorewall-exclusion[12](5)).

interface:address,[...][exclusion]

This form combines the preceding two forms and matches when both the outgoing interface and destination IP address match. May not be used in the PREROUTING chain (:P in the mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in shorewall.conf[13] (5)).

interface:exclusion

This form matches packets leaving through the named interface and whose destination IP address does not match any of the addresses in the exclusion. May not be used in the PREROUTING chain (:P in the mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in shorewall.conf[13] (5)).

$FW

Matches packets originating on the firewall system. May not be used with a chain qualifier (:P, :F, etc.) in the ACTION column.

$FW:address[,...][exclusion]

where address is as above (MAC addresses are not permitted). Matches packets destined for the firewall and whose destination IP address matches one of the listed addresses and does not match any address listed in the exclusion. May not be used with a chain qualifier (:P, :F, etc.) in the ACTION column.

$FW:exclusion

Matches traffic destined for the firewall, provided that the destination IP address does not match any address listed in the exclusion.

Beginning with Shorewall 5.1.0, multiple dest_specs, separated by commas, may be given provided that the following alternative forms are used: (address[,...][exclusion])

interface:(address[,...][exclusion])

interface:(exclusion)

$FW:(address[,...][exclusion])

$FW:(exclusion)

PROTO - {-|{tcp:[!]syn|ipp2p|ipp2p:udp|ipp2p:all|protocol-number|protocol-name|all}[,...]}

See shorewall-rules(5)[2] for details. Beginning with Shorewall 4.5.12, this column can accept a comma-separated list of protocols.

DPORT- {-|port-name-number-or-range[,port-name-number-or-range]...|+ipset}

Optional destination Ports. A comma-separated list of Port names (from services(5)), port numbers or port ranges; if the protocol is icmp, this column is interpreted as the destination icmp-type(s). ICMP types may be specified as a numeric type, a numeric type and code separated by a slash (e.g., 3/4), or a typename. See http://www.shorewall.net/configuration_file_basics.htm#ICMP[14]. If the protocol is ipp2p, this column is interpreted as an ipp2p option without the leading "--" (example bit for bit-torrent). If no PORT is given, ipp2p is assumed.

An entry in this field requires that the PROTO column specify icmp (1), tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if any of the following field is supplied.

Beginning with Shorewall 4.6.0, an ipset name can be specified in this column. This is intended to be used with bitmap:port ipsets.

This column was formerly named DEST PORT(S).

SPORT - {-|port-name-number-or-range[,port-name-number-or-range]...|+ipset}

Optional source port(s). If omitted, any source port is acceptable. Specified as a comma-separated list of port names, port numbers or port ranges. An entry in this field requires that the PROTO column specify tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if any of the following fields is supplied.

Beginning with Shorewall 4.5.15, you may place '=' in this column, provided that the DPORT column is non-empty. This causes the rule to match when either the source port or the destination port in a packet matches one of the ports specified in DEST PORTS(S). Use of '=' requires multi-port match in your iptables and kernel.

Beginning with Shorewall 4.6.0, an ipset name can be specified in this column. This is intended to be used with bitmap:port ipsets.

This column was formerly labelled SOURCE PORT(S).

USER - [!][user-name-or-number][:group-name-or-number][+program-name]

This optional column may only be non-empty if the SOURCE is the firewall itself. When this column is non-empty, the rule applies only if the program generating the output is running under the effective user and/or group specified (or is NOT running under that id if "!" is given).

Examples:

joe

program must be run by joe

:kids

program must be run by a member of the 'kids' group

!:kids

program must not be run by a member of the 'kids' group

+upnpd

\#program named upnpd

Important

The ability to specify a program name was removed from Netfilter in kernel version 2.6.14.

TEST - [!]value[/mask][:C]

Optional - Defines a test on the existing packet or connection mark. The rule will match only if the test returns true. If you don't want to define a test but need to specify anything in the following columns, place a "-" in this field.

!

Inverts the test (not equal)

value

Value of the packet or connection mark.

mask

A mask to be applied to the mark before testing.

:C

Designates a connection mark. If omitted, the packet mark's value is tested.

LENGTH - [length|[min]:[max]]

Optional - packet payload length. This field, if present allow you to match the length of a packet payload (Layer 4 data ) against a specific value or range of values. You must have iptables length support for this to work. A range is specified in the form min:max where either min or max (but not both) may be omitted. If min is omitted, then 0 is assumed; if max is omitted, than any packet that is min or longer will match.

TOS - tos

Type of service. Either a standard name, or a numeric value to match.

```
         Minimize-Delay (16)

         Maximize-Throughput (8)

         Maximize-Reliability (4)

         Minimize-Cost (2)

         Normal-Service (0)
```

CONNBYTES - [!]min:[max[:{O|R|B}[:{B|P|A}]]]

Optional connection Bytes; defines a byte or packet range that the connection must fall within in order for the rule to match. A packet matches if the the packet/byte count is within the range defined by min and max (unless ! is given in which case, a packet matches if the packet/byte count is not within the range). min is an integer which defines the beginning of the byte/packet range. max is an integer which defines the end of the byte/packet range; if omitted, only the beginning of the range is checked. The first letter gives the direction which the range refers to:O - The original direction of the connection. .sp - The opposite direction from the original connection. .sp B - The total of both directions.

If omitted, B is assumed.

The second letter determines what the range refers to.B - Bytes .sp P - Packets .sp A - Average packet size.If omitted, B is assumed.

HELPER - helper

Names a Netfilter protocol helper module such as ftp, sip, amanda, etc. A packet will match if it was accepted by the named helper module. Example: Mark all FTP data connections with mark 4:

```
#ACTION   SOURCE    DEST      PROTO   DPORT      SPORT   USER TEST LENGTH TOS CONNBYTES HELPER
4:T       0.0.0.0/0 0.0.0.0/0 TCP     -          -       -    -    -      -   -         ftp
```

PROBABILITY - [probability]

Added in Shorewall 4.5.0. When non-empty, requires the Statistics Match capability in your kernel and ip6tables and causes the rule to match randomly but with the given probability. The probability is a number 0 < probability <= 1 and may be expressed at up to 8 decimal points of precision.

DSCP - [[!]dscp]

Added in Shorewall 4.5.1. When non-empty, match packets whose Differentiated Service Code Point field matches the supplied value (when '!' is given, the rule matches packets whose DSCP field does not match the supplied value). The dscp value may be given as an even number (hex or decimal) or as the name of a DSCP class. Valid class names and their associated hex numeric values are:

```
    CS0  => 0x00

    CS1  => 0x08

    CS2  => 0x10

    CS3  => 0x18

    CS4  => 0x20

    CS5  => 0x28

    CS6  => 0x30

    CS7  => 0x38

    BE   => 0x00

    AF11 => 0x0a

    AF12 => 0x0c

    AF13 => 0x0e

    AF21 => 0x12

    AF22 => 0x14

    AF23 => 0x16

    AF31 => 0x1a

    AF32 => 0x1c

    AF33 => 0x1e

    AF41 => 0x22

    AF42 => 0x24

    AF43 => 0x26

    EF   => 0x2e
```

STATE -- {NEW|RELATED|ESTABLISHED|INVALID} [,...]

The rule will only match if the packet's connection is in one of the listed states.

TIME - timeelement[&timeelement...]

Added in Shorewall 4.6.2. May be used to limit the rule to a particular time period each day, to particular days of the week or month, or to a range defined by dates and times. Requires time match support in your kernel and ip6tables.

timeelement may be:

timestart=hh:mm[:ss]

Defines the starting time of day.

timestop=hh:mm[:ss]

Defines the ending time of day.

contiguous

Added in Shoreawll 5.0.12. When timestop is smaller than timestart value, match this as a single time period instead of distinct intervals.

utc

Times are expressed in Greenwich Mean Time.

localtz

Deprecated by the Netfilter team in favor of kerneltz. Times are expressed in Local Civil Time (default).

kerneltz

Added in Shorewall 4.5.2. Times are expressed in Local Kernel Time (requires iptables 1.4.12 or later).

weekdays=ddd[,ddd]...

where ddd is one of Mon, Tue, Wed, Thu, Fri, Sat or Sun

monthdays=dd[,dd],...

where dd is an ordinal day of the month

datestart=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]

Defines the starting date and time.

datestop=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]

Defines the ending date and time.

SWITCH - [!]switch-name[={0|1}]

Added in Shorewall 5.1.0 and allows enabling and disabling the rule without requiring shorewall restart. The rule is enabled if the value stored in /proc/net/nf_condition/switch-name is 1. The rule is disabled if that file contains 0 (the default). If '!' is supplied, the test is inverted such that the rule is enabled if the file contains 0.

Within the switch-name, '@0' and '@{0}' are replaced by the name of the chain to which the rule is a added. The switch-name (after '@...' expansion) must begin with a letter and be composed of letters, decimal digits, underscores or hyphens. Switch names must be 30 characters or less in length.

Switches are normally off. To turn a switch on:

echo 1 >

/proc/net/nf_condition/switch-name

To turn it off again: echo 0 >

/proc/net/nf_condition/switch-name

Switch settings are retained over shorewall restart. When the switch-name is followed by =0 or =1, then the switch is initialized to off or on respectively by the start command. Other commands do not affect the switch setting.

## EXAMPLE
IPv4 Example 1:

Mark all ICMP echo traffic with packet mark 1. Mark all peer to peer traffic with packet mark 4. This is a little more complex than otherwise expected. Since the ipp2p module is unable to determine all packets in a connection are P2P packets, we mark the entire connection as P2P if any of the packets are determined to match.

We assume packet/connection mark 0 means unclassified.

```
       #ACTION    SOURCE    DEST         PROTO   DPORT         SPORT   USER    TEST

       MARK(1):T  0.0.0.0/0 0.0.0.0/0    icmp    echo-request

       MARK(1):T  0.0.0.0/0 0.0.0.0/0    icmp    echo-reply

       RESTORE:T  0.0.0.0/0 0.0.0.0/0    all     -             -       -       0

       CONTINUE:T 0.0.0.0/0 0.0.0.0/0    all     -             -       -       !0

       MARK(4):T  0.0.0.0/0 0.0.0.0/0   ipp2p:all

       SAVE:T     0.0.0.0/0 0.0.0.0/0   all     -             -       -       !0
```

If a packet hasn't been classified (packet mark is 0), copy the connection mark to the packet mark. If the packet mark is set, we're done. If the packet is P2P, set the packet mark to 4. If the packet mark has been set, save it to the connection mark.

IPv4 Example 2:

SNAT outgoing connections on eth0 from 192.168.1.0/24 in round-robin fashion between addresses 1.1.1.1, 1.1.1.3, and 1.1.1.9 (Shorewall 4.5.9 and later).

```
/etc/shorewall/mangle:

       #ACTION            SOURCE         DEST         PROTO   DPORT         SPORT   USER    TEST

       CONNMARK(1-3):F    192.168.1.0/24 eth0 ; state=NEW
/etc/shorewall/snat:

       #ACTION          SOURCE              DEST     ...

       SNAT(1.1.1.1)    eth0:192.168.1.0/24 - { mark=1:C }

       SNAT(1.1.1.3)    eth0:192.168.1.0/24 - { mark=2:C }

       SNAT(1.1.1.4)    eth0:192.168.1.0/24 - { mark=3:C }
```

IPv6 Example 1:

Mark all ICMP echo traffic with packet mark 1. Mark all peer to peer traffic with packet mark 4. This is a little more complex than otherwise expected. Since the ipp2p module is unable to determine all packets in a connection are P2P packets, we mark the entire connection as P2P if any of the packets are determined to match.

We assume packet/connection mark 0 means unclassified.

```
       #ACTION    SOURCE    DEST         PROTO   DPORT         SPORT   USER    TEST

       MARK(1):T  ::/0      ::/0         icmp    echo-request

       MARK(1):T  ::/0      ::/0         icmp    echo-reply

       RESTORE:T  ::/0      ::/0         all     -             -       -       0

       CONTINUE:T ::/0      ::/0         all     -             -       -       !0

       MARK(4):T  ::/0      ::/0         ipp2p:all

       SAVE:T     ::/0      ::/0         all     -             -       -       !0
```

If a packet hasn't been classified (packet mark is 0), copy the connection mark to the packet mark. If the packet mark is set, we're done. If the packet is P2P, set the packet mark to 4. If the packet mark has been set, save it to the connection mark.

## FILES
/etc/shorewall/mangle

/etc/shorewall6/mangle

## SEE ALSO
http://www.shorewall.net/traffic_shaping.htm[15]

http://www.shorewall.net/MultiISP.html[3]

http://www.shorewall.net/PacketMarking.html[16]

http://www.shorewall.net/configuration_file_basics.htm#Pairs[17]

shorewall(8)

## NOTES
1.

shorewall-tcrules(5)

http://www.shorewall.net/manpages/shorewall-tcrules.html

2.

shorewall-rules

http://www.shorewall.net/manpages/shorewall-rules.html

3.

http://www.shorewall.net/MultiISP.html

http://www.shorewall.net/MultiISP.html

4.

shorewall.conf(5)

http://www.shorewall.net/manpages/shorewall.conf.html

5.

shorewall-actions(5)

http://www.shorewall.netmanpages/shorewall-actions.html

6.

shorewall-tcdevices

http://www.shorewall.net/manpages/shorewall-tcdevices.html

7.

shorewall-tcclasses

http://www.shorewall.net/manpages/shorewall-tcclasses.html

8.

shorewall-providers(5)

http://www.shorewall.net/manpages/shorewall-providers.html

9.

shorewall-ecn(5)

http://www.shorewall.net/manpages/shorewall-ecn.html

10.

shorewall-actions

http://www.shorewall.net/manpages/shorewall-actions.html

11.

shorewall-interfaces

http://www.shorewall.net/manpages/shorewall-interfaces.html

12.

shorewall-exclusion

http://www.shorewall.net/manpages/shorewall-exclusion.html

13.

shorewall.conf

http://www.shorewall.net/manpages/shorewall.conf

14.

http://www.shorewall.net/configuration_file_basics.htm#ICMP

http://www.shorewall.net/configuration_file_basics.htm#ICMP

15.

http://www.shorewall.net/traffic_shaping.htm

http://www.shorewall.net/traffic_shaping.htm

16.

http://www.shorewall.net/PacketMarking.html

http://www.shorewall.net/PacketMarking.html

17.

http://www.shorewall.net/configuration_file_basics.htm#Pairs

http://www.shorewall.net/configuration_file_basics.htm#Pairs


shorewall-modules

package: shorewall

title: shorewall-modules(5)

summary: Shorewall file

text:
# shorewall-modules(5)

## NAME
modules - Shorewall file

## SYNOPSIS
/usr/share/shorewall[6]/modules

/usr/share/shorewall[6]/helpers

## DESCRIPTION
These files specify which kernel modules Shorewall will load before trying to determine your iptables/kernel's capabilities.

The modules file is used when LOAD_HELPERS_ONLY=No in shorewall.conf[1](8); the helpers file is used when LOAD_HELPERS_ONLY=Yes

Important

Beginning with Shorewall 5.2.3, the LOAD_HELPERS_ONLY option has been removed and the behavior is the same as if LOAD_HELPERS_ONLY=Yes was specified.

Each record in the files has the following format:

loadmodule modulename [moduleoption...]

The modulename names a kernel module (without suffix). Shorewall will search for modules based on your MODULESDIR setting in shorewall.conf[1](8). The moduleoptions are passed to modprobe (if installed) or to insmod.

The /usr/share/shorewall/modules file contains a large number of modules. Users are encouraged to copy the file to /etc/shorewall/modules and modify the copy to load only the modules required or to use LOAD_HELPERS_ONLY=Yes..if n .sp

Note

If you build monolithic kernels and have not installed module-init-tools, then create an empty /etc/shorewall/modules file; that will prevent Shorewall from trying to load modules at all.

## EXAMPLE
loadmodule ip_conntrack_ftp ports=21,221

## FILES
/usr/share/shorewall/modules

/usr/share/shorewall/helpers

/etc/shorewall/modules

/etc/shorewall/helpers

/usr/share/shorewall6/modules

/usr/share/shorewall6/helpers

/etc/shorewall6/modules

/etc/shorewall6/helpers

## SEE ALSO
shorewall(8)

## NOTES
1.

shorewall.conf

http://www.shorewall.net/manpages/shorewall.conf.html


shorewall-names

title: shorewall-names(5)

summary: Shorewall object names

text:
# shorewall-names(5)

## NAME
names - Shorewall object names

## DESCRIPTION
When you define an object in Shorewall (Zone[1], Logical Interface, ipsets[2], Actions[3], etc., you give it a name. Shorewall names start with a letter and consist of letters, digits or underscores ("_"). Except for Zone names, Shorewall does not impose a limit on name length.

When an ipset is referenced, the name must be preceded by a plus sign ("+").

The last character of an interface may also be a plus sign to indicate a wildcard name.

Physical interface names match names shown by 'ip link ls'; if the name includes an at sign ("@"), do not include that character or any character that follows. For example, "sit1@NONE" is referred to as simply 'sit1".

## ZONE AND CHAIN NAMES
For a pair of zones, Shorewall creates two Netfilter chains; one for connections in each direction. The names of these chains are formed by separating the names of the two zones by either "2" or "-".

Example: Traffic from zone A to zone B would go through chain A2B (think "A to B") or "A-B".

In Shorewall 4.6, the default separator is "-" but you can override that by setting ZONE_SEPARATOR="2" in shorewall.conf[4] (5).

Note

Prior to Shorewall 4.6, the default separator was "2".

Zones themselves have names that begin with a letter and are composed of letters, numerals, and "_". The maximum length of a name is dependent on the setting of LOGFORMAT in shorewall.conf[4] (5). See shorewall-zones[1] (5) for details.

## USING DNS NAMES

Caution

I personally recommend strongly against using DNS names in Shorewall configuration files. If you use DNS names and you are called out of bed at 2:00AM because Shorewall won't start as a result of DNS problems then don't say that you were not forewarned.

Host addresses in Shorewall configuration files may be specified as either IP addresses or DNS Names.

DNS names in iptables rules aren't nearly as useful as they first appear. When a DNS name appears in a rule, the iptables utility resolves the name to one or more IP addresses and inserts those addresses into the rule. So changes in the DNS->IP address relationship that occur after the firewall has started have absolutely no effect on the firewall's rule set.

For some sites, using DNS names is very risky. Here's an example:

```
teastep@ursa:~$ dig pop.gmail.com
; <<>> DiG 9.4.2-P1 <<>> pop.gmail.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1774
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 7, ADDITIONAL: 0
;; QUESTION SECTION:
;pop.gmail.com.               IN A
;; ANSWER SECTION:
pop.gmail.com.          300   IN CNAME gmail-pop.l.google.com.
gmail-pop.l.google.com. 300   IN A     209.85.201.109
gmail-pop.l.google.com. 300   IN A     209.85.201.111
```

Note that the TTL is 300 -- 300 seconds is only 5 minutes. So five minutes later, the answer may change!

So this rule may work for five minutes then suddently stop working:

```
#ACTION        SOURCE               DEST              PROTO             DPORT
POP(ACCEPT)    loc                  net:pop.gmail.com
```

There are two options in shorewall[6].conf(5)[4] that affect the use of DNS names in Shorewall[6] config files:

•DEFER_DNS_RESOLUTION - When set to No, DNS names are resolved at compile time; when set to Yes, DNS Names are resolved at runtime.

•AUTOMAKE - When set to Yes, start, restart and reload only result in compilation if one of the files on the CONFIG_PATH has changed since the the last compilation.

So by setting AUTOMAKE=Yes, and DEFER_DNS_RESOLUTION=No, compilation will only take place at boot time if a change had been make to the config but no restart or reload had taken place. This is clearly spelled out in the shorewall.conf manpage. So with these settings, so long as a 'reload' or 'restart' takes place after the Shorewall configuration is changes, there should be no DNS-related problems at boot time.

Important

When DEFER_DNS_RESOLUTION=No and AUTOMAKE=Yes and a DNS change makes it necessary to recompile an existing firewall script, the -c option must be used with the reload or restart command to force recompilation.

If your firewall rules include DNS names then, even if DEFER_DNS_RESOLUTION=No and AUTOMAKE=Yes:

•If your /etc/resolv.confis wrong then your firewall may not start.

•If your /etc/nsswitch.conf is wrong then your firewall may not start.

•If your Name Server(s) is(are) down then your firewall may not start.

•If your startup scripts try to start your firewall before starting your DNS server then your firewall may not start.

•Factors totally outside your control (your ISP's router is down for example), can prevent your firewall from starting.

•You must bring up your network interfaces prior to starting your firewall, or the firewall may not start.

Each DNS name must be fully qualified and include a minimum of two periods (although one may be trailing). This restriction is imposed by Shorewall to insure backward compatibility with existing configuration files.

Example 1. Valid DNS Names

•mail.shorewall.net

•shorewall.net. (note the trailing period).

Example 2. Invalid DNS Names

•mail (not fully qualified)

•shorewall.net (only one period)

DNS names may not be used as:

•The server address in a DNAT rule (/etc/shorewall/rules file)

•In the ADDRESS column of an entry in /etc/shorewall/masq.

•

•In the /etc/shorewall/nat file.

These restrictions are imposed by Netfilter and not by Shorewall.

## LOGICAL INTERFACE NAMES
When dealing with a complex configuration, it is often awkward to use physical interface names in the Shorewall configuration.

•You need to remember which interface is which.

•If you move the configuration to another firewall, the interface names might not be the same.

Beginning with Shorewall 4.4.4, you can use logical interface names which are mapped to the actual interface using the physical option in shorewall-interfaces[5] (5).

Here is an example:

```
#ZONE  INTERFACE  OPTIONS
net    COM_IF     dhcp,blacklist,tcpflags,optional,upnp,routefilter=0,nosmurfs,logmartians=0,physical=eth0
net    EXT_IF     dhcp,blacklist,tcpflags,optional,routefilter=0,nosmurfs,logmartians=0,proxyarp=1,physical=eth2
loc    INT_IF     dhcp,logmartians=1,routefilter=1,tcpflags,nets=172.20.1.0/24,physical=eth1
dmz    VPS_IF     logmartians=1,routefilter=0,routeback,physical=venet0
loc    TUN_IF     physical=tun+
```

In this example, COM_IF is a logical interface name that refers to Ethernet interface eth0, EXT_IF is a logical interface name that refers to Ethernet interface eth2, and so on.

Here are a couple of more files from the same configuration:

shorewall-masq[6] (5):

```
#INTERFACE SOURCE                    ADDRESS
COMMENT Masquerade Local Network
COM_IF     0.0.0.0/0
EXT_IF     !206.124.146.0/24         206.124.146.179:persistent
```

shorewall-providers[7] (5)

```
#NAME   NUMBER   MARK    DUPLICATE  INTERFACE  GATEWAY         OPTIONS               COPY
Avvanta 1        0x10000 main       EXT_IF     206.124.146.254 loose,fallback        INT_IF,VPS_IF,TUN_IF
Comcast 2        0x20000 main       COM_IF     detect          balance               INT_IF,VPS_IF,TUN_IF
```

Note in particular that Shorewall translates TUN_IF to tun* in the COPY column.

## NOTES
1.

Zone

http://www.shorewall.netmanpages/shorewall-zones.html

2.

ipsets

http://www.shorewall.netipsets.html

3.

Actions

http://www.shorewall.netActions.html

4.

shorewall.conf

http://www.shorewall.netmanpages/shorewall.conf.html

5.

shorewall-interfaces

http://www.shorewall.netmanpages/shorewall-interfaces.html

6.

shorewall-masq

http://www.shorewall.netmanpages/shorewall-masq.html

7.

shorewall-providers

http://www.shorewall.netmanpages/shorewall-providers.html


shorewall-nat

title: shorewall-nat(5)

summary: Shorewall one\-to\-one NAT file

text:
# shorewall-nat(5)

## NAME
nat - Shorewall one-to-one NAT file

## SYNOPSIS
/etc/shorewall/nat

## DESCRIPTION
This file is used to define one-to-one Network Address Translation (NAT).

Warning

If all you want to do is simple port forwarding, do NOT use this file. See http://www.shorewall.net/FAQ.htm#faq1[1]. Also, in many cases, Proxy ARP (shorewall-proxyarp[2](5)) or Proxy-NDP(shorewall6-proxyndp[3](5)) is a better solution that one-to-one NAT.

The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax).

EXTERNAL - {address|?COMMENT}

External IP Address - this should NOT be the primary IP address of the interface named in the next column and must not be a DNS Name. If you put ?COMMENT in this column, the rest of the line will be attached as a comment to the Netfilter rule(s) generated by the following entries in the file. The comment will appear delimited by "/* ... */" in the output of "shorewall show nat"

To stop the comment from being attached to further rules, simply include ?COMMENT on a line by itself.

INTERFACE - interfacelist[:[digit]]

Interfaces that have the EXTERNAL address. If ADD_IP_ALIASES=Yes in shorewall.conf[4](5), Shorewall will automatically add the EXTERNAL address to this interface. Also if ADD_IP_ALIASES=Yes, you may follow the interface name with ":" and a digit to indicate that you want Shorewall to add the alias with this name (e.g., "eth0:0"). That allows you to see the alias with ifconfig. That is the only thing that this name is good for -- you cannot use it anywhere else in your Shorewall configuration. Each interface must match an entry in shorewall-interfaces[5](5). Shorewall allows loose matches to wildcard entries in shorewall-interfaces[5](5). For example, ppp0 in this file will match a shorewall-interfaces[5](5) entry that defines ppp+.

If you want to override ADD_IP_ALIASES=Yes for a particular entry, follow the interface name with ":" and no digit (e.g., "eth0:").

INTERNAL - address

Internal Address (must not be a DNS Name).

ALLINTS - [Yes|No]

If Yes or yes, NAT will be effective from all hosts. If No or no (or left empty) then NAT will be effective only through the interface named in the INTERFACE column. This column was formerly labelled ALL INTERFACES.

LOCAL - [Yes|No]

If Yes or yes, NAT will be effective from the firewall system

## RESTRICTIONS
DNAT rules always preempt one-to-one NAT rules. This has subtile consequences when there are sub-zones on an interface. Consider the following:

/etc/shorewall/zones:

```
#ZONE   TYPE    OPTIONS                 IN                      OUT
#                                       OPTIONS                 OPTIONS
fw      firewall
net     ipv4
loc     ipv4
smc:net ipv4
```

/etc/shorewall/interfaces:

```
#ZONE   INTERFACE       OPTIONS
net     eth0            dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0
loc     eth1            tcpflags,nosmurfs,routefilter,logmartians
```

/etc/shorewall/hosts:

```
#ZONE   HOST(S)                                 OPTIONS
smc     eth0:10.1.10.0/24
```

/etc/shorewall/nat:

```
#EXTERNAL       INTERFACE       INTERNAL        ALLINTS         LOCAL
10.1.10.100     eth0            172.20.1.100
```

Note that the EXTERNAL address is in the smc zone.

/etc/shorewall/rules:

```
#ACTION         SOURCE          DEST            PROTO   DPORT   SPORT           ORIGDEST        RATE            USER    MARK    CONNLIMIT       TIME            HEADERS     SWITCH           HELPER
?SECTION ALL
?SECTION ESTABLISHED
?SECTION RELATED
?SECTION INVALID
?SECTION UNTRACKED
?SECTION NEW
...
DNAT            net             loc:172.20.1.4  tcp     80
```

For the one-to-one NAT to work correctly in this configuration, one of two approaches can be taken:

1.Define a CONTINUE policy with smc as the SOURCE zone (preferred):

```
#SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
smc		$FW		CONTINUE
loc		net		ACCEPT
net		all		DROP		info
# THE FOLLOWING POLICY MUST BE LAST
all		all		REJECT		info
```

2.Set IMPLICIT_CONTINUE=Yes in shorewall.conf(5)[4].

## FILES
/etc/shorewall/nat

/etc/shorewall6/nat

## SEE ALSO
http://www.shorewall.net/NAT.htm[6]

http://www.shorewall.net/configuration_file_basics.htm#Pairs[7]

shorewall(8)

## NOTES
1.

http://www.shorewall.net/FAQ.htm#faq1

http://www.shorewall.net/FAQ.htm#faq1

2.

shorewall-proxyarp

http://www.shorewall.net/manpages/shorewall-proxyarp.html

3.

shorewall6-proxyndp

http://www.shorewall.net/manpages6/shorewall6-proxyndp.html

4.

shorewall.conf

http://www.shorewall.net/manpages/shorewall.conf.html

5.

shorewall-interfaces

http://www.shorewall.net/manpages/shorewall-interfaces.html

6.

http://www.shorewall.net/NAT.htm

http://www.shorewall.net/NAT.htm

7.

http://www.shorewall.net/configuration_file_basics.htm#Pairs

http://www.shorewall.net/configuration_file_basics.htm#Pairs


shorewall-nesting

title: shorewall-nesting(5)

summary: Shorewall Nested Zones

text:
# shorewall-nesting(5)

## NAME
nesting - Shorewall Nested Zones

## SYNOPSIS
child-zone[:parent-zone[,parent-zone]...]

## DESCRIPTION
In shorewall-zones[1](5), a zone may be declared to be a sub-zone of one or more other zones using the above syntax. The child-zone may be neither the firewall zone nor a vserver zone. The firewall zone may not appear as a parent zone, although all vserver zones are handled as sub-zones of the firewall zone.

Where zones are nested, the CONTINUE policy in shorewall-policy[2](5) allows hosts that are within multiple zones to be managed under the rules of all of these zones.

## EXAMPLE
/etc/shorewall/zones:

```
        #ZONE    TYPE        OPTION

        fw       firewall

        net      ipv4

        sam:net  ipv4

        loc      ipv4
```

/etc/shorewall/interfaces:

```
        #ZONE     INTERFACE     BROADCAST     OPTIONS

        -         eth0          detect        dhcp,norfc1918

        loc       eth1          detect
```

/etc/shorewall/hosts:

```
        #ZONE     HOST(S)                     OPTIONS

        net       eth0:0.0.0.0/0

        sam       eth0:206.191.149.197
```

/etc/shorewall/policy:

```
        #SOURCE      DEST        POLICY       LOG LEVEL

        loc          net         ACCEPT

        sam          all         CONTINUE

        net          all         DROP         info

        all          all         REJECT       info
```

The second entry above says that when Sam is the client, connection requests should first be processed under rules where the source zone is sam and if there is no match then the connection request should be treated under rules where the source zone is net. It is important that this policy be listed BEFORE the next policy (net to all). You can have this policy generated for you automatically by using the IMPLICIT_CONTINUE option in shorewall.conf[3](5).

Partial /etc/shorewall/rules:

```
        #ACTION   SOURCE    DEST            PROTO    DPORT

        ...

        DNAT      sam       loc:192.168.1.3 tcp      ssh

        DNAT      net       loc:192.168.1.5 tcp      www

        ...
```

Given these two rules, Sam can connect to the firewall's internet interface with ssh and the connection request will be forwarded to 192.168.1.3. Like all hosts in the net zone, Sam can connect to the firewall's internet interface on TCP port 80 and the connection request will be forwarded to 192.168.1.5. The order of the rules is not significant. Sometimes it is necessary to suppress port forwarding for a sub-zone. For example, suppose that all hosts can SSH to the firewall and be forwarded to 192.168.1.5 EXCEPT Sam. When Sam connects to the firewall's external IP, he should be connected to the firewall itself. Because of the way that Netfilter is constructed, this requires two rules as follows:

```
        #ACTION   SOURCE    DEST            PROTO    DPORT

        ...

        ACCEPT+   sam       $FW             tcp      ssh

        DNAT      net       loc:192.168.1.3 tcp      ssh

        ...
```

The first rule allows Sam SSH access to the firewall. The second rule says that any clients from the net zone with the exception of those in the “sam” zone should have their connection port forwarded to 192.168.1.3. If you need to exclude more than one zone, simply use multiple ACCEPT+ rules. This technique also may be used when the ACTION is REDIRECT.

Care must be taken when nesting occurs as a result of the use of wildcard interfaces (interface names ends in '+').

Here's an example. /etc/shorewall/zones:

/etc/shorewall/interfaces:

```
        #ZONE    INTERFACE      BROADCAST        OPTIONS

        net      ppp0

        loc      eth1

        loc      ppp+

        dmz      eth2
```

Because the net zone is declared before the loc zone, net is an implicit sub-zone of loc and in the absence of a net->... CONTINUE policy, traffic from the net zone will not be passed through loc->... rules. But DNAT and REDIRECT rules are an exception!

•DNAT and REDIRECT rules generate two Netfilter rules: a 'nat' table rule that rewrites the destination IP address and/or port number, and a 'filter' table rule that ACCEPTs the rewritten connection.

•Policies only affect the 'filter' table.

As a consequence, the following rules will have unexpected behavior:

```
        #ACTION     SOURCE               DEST      PROTO        DPORT

        ACCEPT      net                  dmz       tcp          80

        REDIRECT    loc                  3128      tcp          80
```

The second rule is intended to redirect local web requests to a proxy running on the firewall and listening on TCP port 3128. But the 'nat' part of that rule will cause all connection requests for TCP port 80 arriving on interface ppp+ (including ppp0!) to have their destination port rewritten to 3128. Hence, the web server running in the DMZ will be inaccessible from the web.

The above problem can be corrected in several ways.

The preferred way is to use the ifname pppd option to change the 'net' interface to something other than ppp0. That way, it won't match ppp+.

If you are running Shorewall version 4.1.4 or later, a second way is to simply make the nested zones explicit:

```
        #ZONE    TYPE        OPTION

        fw       firewall

        loc      ipv4

        net:loc  ipv4

        dmz      ipv4
```

If you take this approach, be sure to set IMPLICIT_CONTINUE=No in shorewall.conf.

When using other Shorewall versions, another way is to rewrite the DNAT rule (assume that the local zone is entirely within 192.168.2.0/23):

```
        #ACTION     SOURCE                 DEST      PROTO      DPORT

        ACCEPT      net                    dmz       tcp        80

        REDIRECT    loc:192.168.2.0/23     3128      tcp        80
```

Another way is to restrict the definition of the loc zone:

/etc/shorewall/interfaces:

```
        #ZONE    INTERFACE      BROADCAST        OPTIONS

        net      ppp0

        loc      eth1

        -        ppp+

        dmz      eth2
```

/etc/shorewall/hosts:

```
        #ZONE    HOST(S)             OPTIONS

        loc      ppp+:192.168.2.0/23
```

## FILES
/etc/shorewall/zones

/etc/shorewall/interfaces

/etc/shorewall/hosts

/etc/shorewall/policy

/etc/shorewall/rules

/etc/shorewall6/zones

/etc/shorewall6/interfaces

/etc/shorewall6/hosts

/etc/shorewall6/policy

/etc/shorewall6/rules

## SEE ALSO
shorewall(8), shorewall-accounting(5), shorewall-actions(5), shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)

## NOTES
1.

shorewall-zones

http://www.shorewall.net/manpages/shorewall-zones.html

2.

shorewall-policy

http://www.shorewall.net/manpages/shorewall-policy.html

3.

shorewall.conf

http://www.shorewall.net/manpages/shorewall.conf.html


shorewall-netmap

title: shorewall-netmap(5)

summary: Shorewall NETMAP definition file

text:
# shorewall-netmap(5)

## NAME
netmap - Shorewall NETMAP definition file

## SYNOPSIS
/etc/shorewall[6]/netmap

## DESCRIPTION
This file is used to map addresses in one network to corresponding addresses in a second network.

Warning

To use this file, your kernel and iptables must have NETMAP support included.

The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax).

TYPE - {DNAT|SNAT}

If DNAT, traffic entering INTERFACE and addressed to NET1 has its destination address rewritten to the corresponding address in NET2. If SNAT, traffic leaving INTERFACE with a source address in NET1 has it's source address rewritten to the corresponding address in NET2.

NET1 - network-address

Network in CIDR format (e.g., 192.168.1.0/24). Beginning with Shorewall 4.4.24, exclusion[1] is supported.

INTERFACE - interface

The name of a network interface. The interface must be defined in shorewall-interfaces[2](5). Shorewall allows loose matches to wildcard entries in shorewall-interfaces[2](5). For example, ppp0 in this file will match a shorewall-interfaces[2](8) entry that defines ppp+.

NET2 - network-address

Network in CIDR format

NET3 (Optional) - network-address

Added in Shorewall 4.4.11. If specified, qualifies INTERFACE. It specifies a SOURCE network for DNAT rules and a DESTINATION network for SNAT rules.

PROTO - protocol-number-or-name

Optional -- added in Shorewall 4.4.23.2. Only packets specifying this protocol will have their IP header modified.

DPORT - port-number-or-name-list

Optional - added in Shorewall 4.4.23.2. Destination Ports. A comma-separated list of Port names (from services(5)), port numbers or port ranges; if the protocol is icmp, this column is interpreted as the destination icmp-type(s). ICMP types may be specified as a numeric type, a numeric type and code separated by a slash (e.g., 3/4), or a typename. See http://www.shorewall.net/configuration_file_basics.htm#ICMP[3]. If the protocol is ipp2p, this column is interpreted as an ipp2p option without the leading "--" (example bit for bit-torrent). If no PORT is given, ipp2p is assumed.

An entry in this field requires that the PROTO column specify icmp (1), tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if any of the following field is supplied.

This column was formerly labelled DEST PORT(S).

SPORT - port-number-or-name-list

Optional -- added in Shorewall 4.4.23.2. Source port(s). If omitted, any source port is acceptable. Specified as a comma-separated list of port names, port numbers or port ranges. An entry in this field requires that the PROTO column specify tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if any of the following fields is supplied.

This column was formerly labelled SOURCE PORT(S).

## FILES
/etc/shorewall/netmap

/etc/shorewall6/netmap

## SEE ALSO
http://www.shorewall.net/netmap.html[4]

http://www.shorewall.net/configuration_file_basics.htm#Pairs[5]

shorewall(8)

## NOTES
1.

exclusion

http://www.shorewall.net/manpages/shorewall-exclusion.html

2.

shorewall-interfaces

http://www.shorewall.net/manpages/shorewall-interfaces.html

3.

http://www.shorewall.net/configuration_file_basics.htm#ICMP

http://www.shorewall.net/configuration_file_basics.htm#ICMP

4.

http://www.shorewall.net/netmap.html

http://www.shorewall.net/netmap.html

5.

http://www.shorewall.net/configuration_file_basics.htm#Pairs

http://www.shorewall.net/configuration_file_basics.htm#Pairs


shorewall-params

title: shorewall-params(5)

summary: Shorewall parameters file

text:
# shorewall-params(5)

## NAME
params - Shorewall parameters file

## SYNOPSIS
/etc/shorewall[6]/params

## DESCRIPTION
Assign any shell variables that you need in this file. The file is always processed by /bin/sh so the full range of shell capabilities may be used.

It is suggested that variable names begin with an upper case letter to distinguish them from variables used internally within the Shorewall programs

The following variable names must be avoided. Those in bold font must be avoided in all Shorewall versions; those in regular font must be avoided in versions prior to 4.4.8.

Any option from shorewall.conf[1]

(5)

COMMAND

CONFDIR

DEBUG

ECHO_E

ECHO_N

EXPORT

FAST

FILEMODE

HOSTNAME

IPT_OPTIONS

NOROUTES

PREVIEW

PRODUCT

PROFILE

PURGE

RECOVERING

RESTOREPATH

RING_BELL

SHAREDIR

Any name beginning with SHOREWALL_ or

SW_

STOPPING

TEST

TIMESTAMP

USE_VERBOSITY

VARDIR

VERBOSE

VERBOSE_OFFSET

VERSION

Example params file:

```
NET_IF=eth0
NET_BCAST=130.252.100.255
NET_OPTIONS=routefilter
```

Example shorewall-interfaces[2](5) file.

```
ZONE    INTERFACE       BROADCAST       OPTIONS
net     $NET_IF         $NET_BCAST      $NET_OPTIONS
```

This is the same as if the interfaces file had contained:

```
ZONE    INTERFACE       BROADCAST       OPTIONS
net     eth0            130.252.100.255 routefilter
```

## FILES
/etc/shorewall/params

/etc/shorewall6/params

## SEE ALSO
http://www.shorewall.net/configuration_file_basics.htm#Variables[3]

shorewall(8)

## NOTES
1.

shorewall.conf

http://www.shorewall.net/manpages/shorewall.conf.html

2.

shorewall-interfaces

http://www.shorewall.net/manpages/shorewall-interfaces.html

3.

http://www.shorewall.net/configuration_file_basics.htm#Variables

http://www.shorewall.net/configuration_file_basics.htm#Variables


shorewall-policy

title: shorewall-policy(5)

summary: Shorewall policy file

text:
# shorewall-policy(5)

## NAME
policy - Shorewall policy file

## SYNOPSIS
/etc/shorewall[6]/policy

## DESCRIPTION
This file defines the high-level policy for connections between zones defined in shorewall-zones[1](5).

Important

The order of entries in this file is important

This file determines what to do with a new connection request if we don't get a match from the shorewall-blrules[2](5) or shorewall-rules[3](5) files. For each source/destination pair, the file is processed in order until a match is found ("all" will match any source or destination).

Important

Intra-zone policies are pre-defined

For $FW and for all of the zones defined in shorewall-zones[1](5), the POLICY for connections from the zone to itself is ACCEPT (with no logging or TCP connection rate limiting) but may be overridden by an entry in this file. The overriding entry must be explicit (specifying the zone name in both SOURCE and DEST) or it must use "all+" (Shorewall 4.5.17 or later).

Similarly, if you have IMPLICIT_CONTINUE=Yes in shorewall.conf[4](5), then the implicit policy to/from any sub-zone is CONTINUE. These implicit CONTINUE policies may also be overridden by an explicit entry in this file.

The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax).

SOURCE - zone[,...[+]]|$FW|all[+][!ezone[,...]]

Source zone. Must be the name of a zone defined in shorewall-zones[1](5), $FW, "all" or "all+". Support for all+ was added in Shorewall 4.5.17. all does not override the implicit intra-zone ACCEPT policy while all+ does.

Beginning with Shorewall 5.0.12, multiple zones may be listed separated by commas. As above, if '+' is specified after two or more zone names, then the policy overrides the implicit intra-zone ACCEPT policy if the same zone appears in both the SOURCE and DEST columns.

Beginning with Shorewall 5.2.3, a comma-separated list of excluded zones preceded by "!" may follow all or all+.

DEST - zone[,...[+]]|$FW|all[+][!ezone[,...]]

Destination zone. Must be the name of a zone defined in shorewall-zones[1](5), $FW, "all" or "all+". If the DEST is a bport zone, then the SOURCE must be "all", "all+", another bport zone associated with the same bridge, or it must be an ipv4 zone that is associated with only the same bridge. Support for "all+" was added in Shorewall 4.5.17. "all" does not override the implicit intra-zone ACCEPT policy while "all+" does.

Beginning with Shorewall 5.0.12, multiple zones may be listed separated by commas. As above, if '+' is specified after two or more zone names, then the policy overrides the implicit intra-zone ACCEPT policy if the same zone appears in both the SOURCE and DEST columns.

Beginning with Shorewall 5.2.3, a comma-separated list of excluded zones preceded by "!" may follow all or all+.

POLICY - {ACCEPT|DROP|REJECT|BLACKLIST|CONTINUE|QUEUE|NFQUEUE[(queuenumber1[:queuenumber2])]|NONE}[:{[+]policy-action[:level][,...]|None}]

Policy if no match from the rules file is found. If the policy is neither CONTINUE nor NONE then the policy may be followed by ":" and one of the following:

1.The word "None" or "none". This causes any default action defined in shorewall.conf[4](5) to be omitted for this policy.

2.The name of an action with optional parameters enclosed in parentheses. The action will be invoked before the policy is enforced.

Actions can have parameters specified.

Beginning with Shorewall 4.5.10, the action name can be followed optionally by a colon and a log level. The level will be applied to each rule in the action or body that does not already have a log level.

Beginning with Shorewall 5.1.2, multiple action[:level] specification may be listeded, separated by commas. The actions are invoked in the order listed. Also beginning with Shorewall 5.1.2, the policy-action list can be prefixed with a plus sign ("+") indicating that the listed actions are in addition to those listed in the related _DEFAULT setting in shorewall.conf[4](5).

Possible policies are:

ACCEPT

Accept the connection.

DROP

Ignore the connection request.

REJECT

For TCP, send RST. For all other, send an "unreachable" ICMP.

BLACKLIST

Added in Shorewall 5.1.1 and requires that the DYNAMIC_BLACKLIST setting in shorewall.conf[4](5) specifies ipset-based dynamic blacklisting. The SOURCE IP address is added to the blacklist ipset and the connection request is ignored.

QUEUE

Queue the request for a user-space application such as Snort-inline.

NFQUEUE

Queue the request for a user-space application using the nfnetlink_queue mechanism. If a queuenumber1 is not given, queue zero (0) is assumed. Beginning with Shorewall 4.6.10, a second queue number (queuenumber2) may be given. This specifies a range of queues to use. Packets are then balanced across the given queues. This is useful for multicore systems: start multiple instances of the userspace program on queues x, x+1, .. x+n and use "x:x+n". Packets belonging to the same connection are put into the same nfqueue.

CONTINUE

Pass the connection request past any other rules that it might also match (where the source or destination zone in those rules is a superset of the SOURCE or DEST in this policy). See shorewall-nesting[5](5) for additional information.

NONE

Assume that there will never be any packets from this SOURCE to this DEST. Shorewall will not create any infrastructure to handle such packets and you may not have any rules with this SOURCE and DEST in the /etc/shorewall/rules file. If such a packet is received, the result is undefined. NONE may not be used if the SOURCE or DEST columns contain the firewall zone ($FW) or "all".

LOGLEVEL (loglevel) - [log-level|ULOG|NFLOG]

Optional - if supplied, each connection handled under the default POLICY is logged at that level. If not supplied, no log message is generated. See syslog.conf(5) for a description of log levels. You may also specify ULOG or NFLOG (must be in upper case). This will log to the ULOG or NFLOG target and will send to a separate log through use of ulogd (http://www.netfilter.org/projects/ulogd/index.html).

For a description of logging, see shorewall-logging(5)[6].

If you don't want to log but need to specify the following column, place "-" here.

RATE (rate) - [-|limit]

where limit is one of: [-|[{s|d}[/vlsm]:[[name][(ht-buckets,ht-max)]:]]]rate/{sec|min|hour|day}[:burst]

[name1:]rate1/{sec|min|hour|day}[:burst1],[name2:]rate2/{sec|min|hour|day}[:burst2]

If passed, specifies the maximum TCP connection rate and the size of an acceptable burst. If not specified, TCP connections are not limited. If the burst parameter is omitted, a value of 5 is assumed. When s: or d: is specified, the rate applies per source IP address or per destination IP address respectively. The name may be chosen by the user and specifies a hash table to be used to count matching connections. If not give, the name shorewall is assumed. Where more than one POLICY or rule specifies the same name, the connections counts for the policies are aggregated and the individual rates apply to the aggregated count. Beginning with Shorewall 5.2.1, the s or d may be followed by a slash ("/") and an integer vlsm. When a vlsm is specified, all source or destination addresses encountered will be grouped according to the given prefix length and the so-created subnet will be subject to the rate limit.

Beginning with Shorewall 4.6.5, two limits may be specified, separated by a comma. In this case, the first limit (name1, rate1, burst1) specifies the per-source IP limit and the second limit specifies the per-destination IP limit.

Example: client:10/sec:20,:60/sec:100

Beginning with Shorewall 5.2.1, the table name, if any, may be followed by two integers separated by commas and enclosed in parentheses. The first integer (ht-buckets) specifies the number of buckets in the generated hash table. The second integer (ht-max) specifies the maximum number of entries in the hash table.

Example: s:client(1024,65536):10/sec

CONNLIMIT - limit[:mask]

May be used to limit the number of simultaneous connections from each individual host to limit connections. While the limit is only checked on connections to which this policy could apply, the number of current connections is calculated over all current connections from the SOURCE host. By default, the limit is applied to each host individually but can be made to apply to networks of hosts by specifying a mask. The mask specifies the width of a VLSM mask to be applied to the source address; the number of current connections is then taken over all hosts in the subnet source-address/mask.

## EXAMPLE
1.All connections from the local network to the internet are allowed

2.All connections from the internet are ignored but logged at syslog level KERNEL.INFO.

3.All other connection requests are rejected and logged at level KERNEL.INFO.

```
        #SOURCE         DEST            POLICY          LOG           BURST:LIMIT

        #                                               LEVEL

        loc             net             ACCEPT

        net             all             DROP            info

        #

        # THE FOLLOWING POLICY MUST BE LAST

        #

        all             all             REJECT          info
```

## FILES
/etc/shorewall/policy

/etc/shorewall6/policy

## SEE ALSO
http://www.shorewall.net/configuration_file_basics.htm#Pairs[7]

shorewall(8)

## NOTES
1.

shorewall-zones

http://www.shorewall.net/manpages/shorewall-zones.html

2.

shorewall-blrules

http://www.shorewall.net/manpages/shorewall-blrules.html

3.

shorewall-rules

http://www.shorewall.net/manpages/shorewall-rules.html

4.

shorewall.conf

http://www.shorewall.net/manpages/shorewall.conf.html

5.

shorewall-nesting

http://www.shorewall.net/manpages/shorewall-nesting.html

6.

shorewall-logging(5)

http://www.shorewall.net/shorewall_logging.html

7.

http://www.shorewall.net/configuration_file_basics.htm#Pairs

http://www.shorewall.net/configuration_file_basics.htm#Pairs


shorewall-providers

title: shorewall-providers(5)

summary: Shorewall Providers file

text:
# shorewall-providers(5)

## NAME
providers - Shorewall Providers file

## SYNOPSIS
/etc/shorewall/providers

## DESCRIPTION
This file is used to define additional routing tables. You will want to define an additional table if:

•You have connections to more than one ISP or multiple connections to the same ISP

•You run Squid as a transparent proxy on a host other than the firewall.

•You have other requirements for policy routing.

Each entry in the file defines a single routing table.

If you wish to omit a column entry but want to include an entry in the next column, use "-" for the omitted entry.

The columns in the file are as follows.

NAME - name

The provider name. Must be a valid shell variable name. The names 'local', 'main', 'default' and 'unspec' are reserved and may not be used as provider names.

NUMBER - number

The provider number -- a number between 1 and 15. Each provider must be assigned a unique value.

MARK (Optional) - value

A FWMARK value used in your shorewall-mangle(5)[1] file to direct packets to this provider. If PROVIDER_OFFSET is non-zero in shorewall.conf(5)[2], then the value must be a multiple of 2^^PROVIDER_OFFSET. In all cases, the number of significant bits may not exceed PROVIDER_OFFSET + PROVIDER_BITS.

DUPLICATE - routing-table-name

The name of an existing table to duplicate to create this routing table. May be main or the name of a previously listed provider. You may select only certain entries from the table to copy by using the COPY column below. This column should contain a dash ("-') when USE_DEFAULT_RT=Yes in shorewall.conf(5)[2].

INTERFACE - interface[:address]

The name of the network interface to the provider. Must be listed in shorewall-interfaces(5)[3]. In general, that interface should not have the proxyarp or proxyndp option specified unless loose is given in the OPTIONS column of this entry.

Important

For IPv6, if the interface is an Ethernet device and an IP address is supplied, it should be the upstream router's link-level address, not its global address.

Where more than one provider is serviced through a single interface, the interface must be followed by a colon and the IP address of the interface that is supplied by the associated provider.

GATEWAY - {-|address[,mac]|detect|none}

The IP address of the provider's gateway router. Beginning with Shorewall 4.6.2, you may also specify the MAC address of the gateway when there are multiple providers serviced through the same interface. When the MAC is not specified, Shorewall will detect the MAC during firewall start or restart. You can enter detect here and Shorewall will attempt to detect the gateway automatically.

Beginning with Shorewall 5.0.6, you may also enter none. This causes creation of a routing table with no default route in it.

For PPP devices, you may omit this column.

OPTIONS (Optional) - [-|option[,option]...]

A comma-separated list selected from the following. The order of the options is not significant but the list may contain no embedded white-space. autosrc

Added in Shorewall 4.5.17. Causes a host route to the provider's gateway router to be added to the provider's routing table. This is the default behavior unless overridden by a following noautosrc option.

track

If specified, inbound connections on this interface are to be tracked so that responses may be routed back out this same interface. You want to specify track if internet hosts will be connecting to local servers through this provider.

Beginning with Shorewall 4.4.3, track defaults to the setting of the TRACK_PROVIDERS option in shorewall.conf[2] (5). If you set TRACK_PROVIDERS=Yes and want to override that setting for an individual provider, then specify notrack (see below).

balance[=weight]

The providers that have balance specified will get outbound traffic load-balanced among them. By default, all interfaces with balance specified will have the same weight (1). You can change the weight of an interface by specifying balance=weight where weight is the weight of the route out of this interface. Prior to Shorewall 5.1.1, when USE_DEFAULT_RT=Yes, balance=1 is assumed unless the fallback, loose, load or tproxy option is specified. Beginning with Shorewall 5.1.1, when BALANCE_PROVIDERS=Yes, balance=1 is assumed unless the fallback, loose, load or tproxy option is specified.I

Caution

In IPV6, the balance option does not cause balanced default routes to be created; it rather causes a sequence of default routes with different metrics to be created.

loose

Shorewall normally adds a routing rule for each IP address on an interface which forces traffic whose source is that IP address to be sent using the routing table for that interface. Setting loose prevents creation of such rules on this interface.

load=probability

Added in Shorewall 4.6.0. This option provides an alternative method of load balancing based on probabilities. Providers to be balanced are given a probability (a number 0 > n >= 1) with up to 8 digits to the right of the decimal point. Beginning with Shorewall 4.6.10, a warning is issued if the sum of the probabilities is not 1.00000000.

noautosrc

Added in Shorewall 4.5.17. Prevents the addition of a host route to the provider's gateway router from being added to the provider's routing table. This option must be used with caution as it can cause start and restart failures.

notrack

Added in Shorewall 4.4.3. When specified, turns off track.

optional (deprecated for use with providers that do not share an interface)

If the interface named in the INTERFACE column is not up and configured with an IPv4 address then ignore this provider. If not specified, the value of the optional option for the INTERFACE in shorewall-interfaces(5)[3] is assumed. Use of that option is preferred to this one, unless an address is provider in the INTERFACE column.

primary

Added in Shorewall 4.6.6, primary is equivalent to balance=1 and is preferred when the remaining providers specify fallback or tproxy.

src=source-address

Specifies the source address to use when routing to this provider and none is known (the local client has bound to the 0 address). May not be specified when an address is given in the INTERFACE column. If this option is not used, Shorewall substitutes the primary IP address on the interface named in the INTERFACE column.

mtu=number

Specifies the MTU when forwarding through this provider. If not given, the MTU of the interface named in the INTERFACE column is assumed.

fallback[=weight]

Indicates that a default route through the provider should be added to the default routing table (table 253). If a weight is given, a balanced route is added with the weight of this provider equal to the specified weight. If the option is given without a weight, an separate default route is added through the provider's gateway; the route has a metric equal to the provider's NUMBER. Prior to Shorewall 4.4.24, the option is ignored with a warning message if USE_DEFAULT_RT=Yes in shorewall.conf.

Caution

In IPV6, specifying the fallback option on multiple providers does not cause balanced fallback routes to be created; it rather causes a sequence of fallback routes with different metrics to be created.

tproxy

Added in Shorewall 4.5.4. Used for supporting the TPROXY action in shorewall-mangle(5). See http://www.shorewall.net/Shorewall_Squid_Usage.html[4]. When specified, the MARK, DUPLICATE and GATEWAY columns should be empty, INTERFACE should be set to 'lo' and tproxy should be the only OPTION. Only one tproxy provider is allowed.

hostroute

Added in Shorewall 4.5.21. This is the default behavior that results in a host route to the defined GATEWAY being inserted into the main routing table and into the provider's routing table. hostroute is required for older distributions but nohostroute (below) is appropriate for recent distributions. hostroute may interfere with Zebra's ability to add routes on some distributions such as Debian 7. This option defaults to on when BALANCE_PROVIDERS=Yes, in shorewall.conf(5)[2].

nohostroute

Added in Shorewall 4.5.21. nohostroute inhibits addition of a host route to the defined GATEWAY being inserted into the main routing table and into the provider's routing table. nohostroute is not appropriate for older distributions but is appropriate for recent distributions. nohostroute allows Zebra's to correctly add routes on some distributions such as Debian 7. This option defaults to off when BALANCE_PROVIDERS=Yes, in shorewall.conf(5)[2].

persistent

Added in Shorewall 5.0.2 and alters the behavior of the disable command:

•The provider's routing table still contains the apprioriate default route.

•Unless the noautosrc option is specified, routing rules are generated to route traffic from the interfaces address(es) out of the provider's routing table.

•Persistent routing rules in shorewall-rtrules(5)[5] are present.

Note

The generated script will attempt to reenable a disabled persistent provider during execution of the start, restart and reload commands. When persistent is not specified, only the enable and reenable commands can reenable the provider.

Important

RESTORE_DEFAULT_ROUTE=Yes in shorewall[6].conf is not recommended when the persistent option is used, as restoring default routes to the main routing table can prevent link status monitors such as foolsm from correctly detecting non-working providers.

COPY - [{none|interface[,interface]...}]

A comma-separated list of other interfaces on your firewall. Wildcards specified using an asterisk ("*") are permitted (e.g., tun* ). Usually used only when DUPLICATE is main. Only copy routes through INTERFACE and through interfaces listed here. If you only wish to copy routes through INTERFACE, enter none in this column. Beginning with Shorewall 4.5.17, blackhole, unreachable and prohibit routes are no longer copied by default but may be copied by including blackhole,unreachable and prohibit respectively in the COPY list.

## EXAMPLES
IPv4 Example 1:

You run squid in your DMZ on IP address 192.168.2.99. Your DMZ interface is eth2

```
        #NAME   NUMBER  MARK DUPLICATE  INTERFACE GATEWAY       OPTIONS

        Squid   1       1    -          eth2      192.168.2.99  -
```

IPv4 Example 2:

eth0 connects to ISP 1. The IP address of eth0 is 206.124.146.176 and the ISP's gateway router has IP address 206.124.146.254. eth1 connects to ISP 2. The IP address of eth1 is 130.252.99.27 and the ISP's gateway router has IP address 130.252.99.254.

eth2 connects to a local network.

```
        #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY          OPTIONS            COPY

        ISP1  1       1    main      eth0      206.124.146.254 track,balance      eth2

        ISP2  2       2    main      eth1      130.252.99.254  track,balance      eth2
```

IPv6 Example 1:

You run squid in your DMZ on IP address 2002:ce7c:92b4:1::2. Your DMZ interface is eth2

```
        #NAME   NUMBER  MARK DUPLICATE  INTERFACE GATEWAY              OPTIONS

        Squid   1       1    -          eth2      2002:ce7c:92b4:1::2  -
```

IPv6 Example 2:

eth0 connects to ISP 1. The ISP's gateway router has IP address 2001:ce7c:92b4:1::2. eth1 connects to ISP 2. The ISP's gateway router has IP address 2001:d64c:83c9:12::8b.

eth2 connects to a local network.

```
        #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY               OPTIONS    COPY

        ISP1  1       1    main      eth0     2001:ce7c:92b4:1::2   track      eth2

        ISP2  2       2    main      eth1     2001:d64c:83c9:12::8b track      eth2
```

## FILES
/etc/shorewall/providers

/etc/shorewall6/providers

## SEE ALSO
http://www.shorewall.net/MultiISP.html[6]

http://www.shorewall.net/configuration_file_basics.htm#Pairs[7]

shorewall(8)

## NOTES
1.

shorewall-mangle(5)

http://www.shorewall.net/manpages/shorewall-mangle.html

2.

shorewall.conf(5)

http://www.shorewall.net/manpages/shorewall.conf.html

3.

shorewall-interfaces(5)

http://www.shorewall.net/manpages/shorewall-interfaces.html

4.

http://www.shorewall.net/Shorewall_Squid_Usage.html

http://www.shorewall.net/Shorewall_Squid_Usage.html

5.

shorewall-rtrules(5)

http://www.shorewall.netshorewall-rtrules.html

6.

http://www.shorewall.net/MultiISP.html

http://www.shorewall.net/MultiISP.html

7.

http://www.shorewall.net/configuration_file_basics.htm#Pairs

http://www.shorewall.net/configuration_file_basics.htm#Pairs


shorewall-proxyarp

title: shorewall-proxyarp(5)

summary: Shorewall Proxy ARP file

text:
# shorewall-proxyarp(5)

## NAME
proxyarp - Shorewall Proxy ARP file

## SYNOPSIS
/etc/shorewall/proxyarp

## DESCRIPTION
IPv4 only.

This file is used to define Proxy ARP. There is one entry in this file for each IP address to be proxied.

The columns in the file are as follows.

ADDRESS - address

IP Address.

INTERFACE - interface (Optional as of Shorewall 4.4.16)

Local interface where system with the ip address in ADDRESS is connected. This column is only required when HAVEROUTE is set to No (no) or is left empty.

EXTERNAL - interface

External Interface to be used to access this system from the Internet.

HAVEROUTE - [-|Yes|No]

If there is already a route from the firewall to the host whose address is given, enter Yes or yes in this column. Otherwise, enter no or No or leave the column empty and Shorewall will add the route for you. If Shorewall adds the route, its persistence depends on the value of thePERSISTENT column contains Yes; otherwise, shorewall stop or shorewall clear will delete the route.

PERSISTENT - [-|Yes|No]

If HAVEROUTE is No or no, then the value of this column determines if the route added by Shorewall persists after a shorewall stop or a shorewall clear. If this column contains Yes or yes then the route persists; If the column is empty or contains No or no then the route is deleted by shorewall stop or shorewall clear.

## EXAMPLE
Example 1:

Host with IP 155.186.235.6 is connected to interface eth1 and we want hosts attached via eth0 to be able to access it using that address.

```
       #ADDRESS        INTERFACE       EXTERNAL

       155.186.235.6   eth1            eth0
```

## FILES
/etc/shorewall/proxyarp

## SEE ALSO
http://www.shorewall.net/ProxyARP.htm[1]

http://www.shorewall.net/configuration_file_basics.htm#Pairs[2]

shorewall(8)

## NOTES
1.

http://www.shorewall.net/ProxyARP.htm

http://www.shorewall.net/ProxyARP.htm

2.

http://www.shorewall.net/configuration_file_basics.htm#Pairs

http://www.shorewall.net/configuration_file_basics.htm#Pairs


shorewall-proxyndp

title: shorewall-proxyndp(5)

summary: Shorewall6 Proxy NDP file

text:
# shorewall-proxyndp(5)

## NAME
proxyndp - Shorewall6 Proxy NDP file

## SYNOPSIS
/etc/shorewall6/proxyndp

## DESCRIPTION
This file was added in Shorewall 4.4.16 and is used to define Proxy NDP. There is one entry in this file for each IPv6 address to be proxied.

The columns in the file are as follows.

ADDRESS - address

IPv6 Address.

INTERFACE - interface (Optional)

Local interface where system with the ip address in ADDRESS is connected. Only required when the HAVEROUTE column is left empty or is set to no or No.

EXTERNAL - interface

External Interface to be used to access this system from the Internet.

HAVEROUTE - [-|Yes|No]

If there is already a route from the firewall to the host whose address is given, enter Yes or yes in this column. Otherwise, enter no or No or leave the column empty and Shorewall will add the route for you. If Shorewall6 adds the route, its persistence depends on the value of thePERSISTENT column contains Yes; otherwise, shorewall6 stop or shorewall clear6 will delete the route.

PERSISTENT - [-|Yes|No]

If HAVEROUTE is No or no, then the value of this column determines if the route added by Shorewall persists after a shorewall6 stop or a shorewall6 clear. If this column contains Yes or yes then the route persists; If the column is empty or contains No or no then the route is deleted by shorewall6 stop or shorewall6 clear.

## EXAMPLE
Example 1:

Host with IPv6 2001:470:b:227::44 is connected to interface eth1 and we want hosts attached via eth0 to be able to access it using that address.

```
       #ADDRESS             INTERFACE       EXTERNAL

       2001:470:b:227::44   eth1            eth0
```

## FILES
/etc/shorewall6/proxyndp

## SEE ALSO
http://www.shorewall.net/configuration_file_basics.htm#Pairs[1]

shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-exclusion(5), shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5), shorewall6-nesting(5), shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5), shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)

## NOTES
1.

http://www.shorewall.net/configuration_file_basics.htm#Pairs

http://www.shorewall.net/configuration_file_basics.htm#Pairs


shorewall-routes

title: shorewall-routes(5)

summary: Shorewall file

text:
# shorewall-routes(5)

## NAME
routes - Shorewall file

## SYNOPSIS
/etc/shorewall[6]/routes

## DESCRIPTION
This file was added in Shorewall 4.4.15 and is used to define routes to be added to provider routing tables.

The columns in the file are as follows.

PROVIDER

The name or number of a provider defined in shorewall-providers[1] (5). Beginning with Shorewall 4.5.14, you may also enter main in this column to add routes to the main routing table.

DEST

Destination host address or network address.

GATEWAY (Optional)

If specified, gives the IP address of the gateway to the DEST. Beginning with Shorewall 4.5.14, you may specify blackhole in this column to create a blackhole route.

Beginning with Shorewall 4.5.15, you may specify prohibit or unreachable in this column to create a prohibit or unreachable route respectively.

DEVICE (Optional)

Specifies the device route. If neither DEVICE nor GATEWAY is given, then the INTERFACE specified for the PROVIDER in shorewall-providers[1] (5). This column must be omitted if blackhole, prohibit or unreachable is specified in the GATEWAY column.

OPTIONS (Optional)

Added in Shorewall 5.0.2. Allowed options are:

persistent

If specified, the route remains in the provider's routing table even when the provider is disabled.

## FILES
/etc/shorewall/routes

/etc/shorewall6/routes

## SEE ALSO
http://www.shorewall.net/configuration_file_basics.htm#Pairs[2]

shorewall(8)

## NOTES
1.

shorewall-providers

http://www.shorewall.net/manpages/shorewall-providers.html

2.

http://www.shorewall.net/configuration_file_basics.htm#Pairs

http://www.shorewall.net/configuration_file_basics.htm#Pairs


shorewall-rtrules

title: shorewall-rtrules(5)

summary: Shorewall Routing Rules file

text:
# shorewall-rtrules(5)

## NAME
rtrules - Shorewall Routing Rules file

## SYNOPSIS
/etc/shorewall[6]/rtrules

## DESCRIPTION
Entries in this file cause traffic to be routed to one of the providers listed in shorewall-providers[1](5).

The columns in the file are as follows.

SOURCE (Optional) - {-|[&]interface|address|interface:address}

An ip address (network or host) that matches the source IP address in a packet. May also be specified as an interface name optionally followed by ":" and an address. If the device lo is specified, the packet must originate from the firewall itself. Beginning with Shorewall 4.5.0, you may specify &interface in this column to indicate that the source is the primary IP address of the named interface.

Beginning with Shorewall 4.6.8, you may specify a comma-separated list of addresses in this column.

DEST (Optional) - {-|address}

An ip address (network or host) that matches the destination IP address in a packet. If you choose to omit either SOURCE or DEST, place "-" in that column. Note that you may not omit both SOURCE and DEST.

Beginning with Shorewall 4.6.8, you may specify a comma-separated list of addresses in this column.

PROVIDER - {provider-name|provider-number|main}

The provider to route the traffic through. May be expressed either as the provider name or the provider number. May also be main or 254 for the main routing table. This can be used in combination with VPN tunnels, see example 2 below.

PRIORITY - priority[!]

The rule's numeric priority which determines the order in which the rules are processed. Rules with equal priority are applied in the order in which they appear in the file. 1000-1999

Before Shorewall-generated 'MARK' rules

11000-11999

After 'MARK' rules but before Shorewall-generated rules for ISP interfaces.

26000-26999

After ISP interface rules but before 'default' rule.

Beginning with Shorewall 5.0.2, the priority may be followed optionally by an exclaimation mark ("!"). This causes the rule to remain in place if the interface is disabled.

Caution

Be careful when using rules of the same PRIORITY as some unexpected behavior can occur when multiple rules have the same SOURCE. For example, in the following rules, the second rule overwrites the first unless the priority in the second is changed to 19001 or higher:

```
10.10.0.0/24    192.168.5.6 provider1 19000
10.10.0.0/24    -           provider2 19000
```

MARK - {-|mark[/mask]}

Optional -- added in Shorewall 4.4.25. For this rule to be applied to a packet, the packet's mark value must match the mark when logically anded with the mask. If a mask is not supplied, Shorewall supplies a suitable provider mask.

## EXAMPLES
Example 1:

You want all traffic coming in on eth1 to be routed to the ISP1 provider.

```
        #SOURCE                 DEST            PROVIDER        PRIORITY      MASK

        eth1                    -               ISP1            1000
```

IPv4 Example 2:

You use OpenVPN (routed setup /tunX) in combination with multiple providers. In this case you have to set up a rule to ensure that the OpenVPN traffic is routed back through the tunX interface(s) rather than through any of the providers. 10.8.0.0/24 is the subnet chosen in your OpenVPN configuration (server 10.8.0.0 255.255.255.0).

```
         #SOURCE                 DEST            PROVIDER        PRIORITY     MASK

         -                       10.8.0.0/24     main            1000
```

## FILES
/etc/shorewall/rtrules

/etc/shorewall6/rtrules

## SEE ALSO
http://www.shorewall.net/MultiISP.html[2]

http://www.shorewall.net/configuration_file_basics.htm#Pairs[3]

shorewall(8)

## NOTES
1.

shorewall-providers

http://www.shorewall.net/manpages/shorewall-providers.html

2.

http://www.shorewall.net/MultiISP.html

http://www.shorewall.net/MultiISP.html

3.

http://www.shorewall.net/configuration_file_basics.htm#Pairs

http://www.shorewall.net/configuration_file_basics.htm#Pairs